Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security Crime

Western Energy Companies Under Sabotage Threat 86

Posted by timothy from the shame-if-anything-was-t'-happen dept.
An anonymous reader writes In a post published Monday, Symantec writes that western countries including the U.S., Spain, France, Italy, Germany, Turkey, and Poland are currently the victims of an ongoing cyberespionage campaign. The group behind the operation, called Dragonfly by Symantec, originally targeted aviation and defense companies as early as 2011, but in early 2013, they shifted their focus to energy firms. They use a variety of malware tools, including remote access trojans (RATs) and operate during Eastern European business hours. Symantec compares them to Stuxnet except that "Dragonfly appears to have a much broader focus with espionage and persistent access as its current objective with sabotage as an optional capability if required."
This discussion has been archived. No new comments can be posted.

Western Energy Companies Under Sabotage Threat More

Western Energy Companies Under Sabotage Threat

Comments Filter:

  • Dragonfly by Symantec (Score:5, Funny)

    by OzPeter ( 195038 ) on Tuesday July 01, 2014 @10:14AM (#47359759)

    I read The group behind the operation, called Dragonfly by Symantec as that Symantec had a group called Dragonfly, and they were performing the espionage.

    And my thought processes didn't toss that out as being unreasonable.

    • Re: (Score:1)

      by Anonymous Coward

      That anti-malware companies have been the source of malware is a constant rumor. Ever since the Internet was opened to the public. And, before.
      I remember the days when sneaker-net was used even among Macs on the first AppleTalk networks at the company that I worked at. One network kept getting viruses. A consultant was called in to find and eliminate the virus. This happened several times before they discovered the source of the virus was a 3.5" floppy disk that the virus-busting consultant gave to an

    • you know it's working by the buzz your production machinery makes on the other side of the office wall. well, almost more or a roar....

  • Attribution (Score:4, Interesting)

    by Ceriel Nosforit ( 682174 ) on Tuesday July 01, 2014 @10:29AM (#47359947)

    "...the group mostly worked between Monday and Friday, with activity mainly concentrated in a nine-hour period that corresponded to a 9am to 6pm working day in the UTC +4 time zone."

    Which government has working days like that? Is it the Russians?

    • Re: (Score:3, Informative)

      by thieh ( 3654731 )
      Anywhere from Eastern Europe (UTC+2, 7AM-4PM) to Myanmar (UTC+6:30, 11:30AM-8:30PM) would also be reasonable, no?

      • No, it would not... Government bureaucracy so rigid that we can have much better guesses than that. We should be able to eliminate most countries in this range, and their enemies to accommodate false-flag ops, and subtract according to capability. You get a short-list and then you just wait for the smoking gun.

    • Re: (Score:3)

      by PPH ( 736903 )

      Iran? If they start work at 8:00.

      • Iran? If they start work at 8:00.

        Iran 46 Saturday-Thursday 8 and 6hours Thursdays

        - https://en.wikipedia.org/wiki/... [wikipedia.org]

        Well well well!

        Israel: Sunday-Thursday, 8.5h
        Russia: Monday-Friday, 8h
        United Arab Emirates: Sunday-Thursday, 8h
        Saudi Arabia: Sunday-Thursday, 10h

        China: Monday-Friday, hours unlisted.

        So the short-list got shorter. Here I was thinking everybody worked the same days.

        Usual business hours in Russia:

        Banks 8am or 9am-5pm or 6pm Mon-Fri

        Offices 8am or 9am-5pm or 6pm Mon-Fri

        - http://www.lonelyplanet.com/ru... [lonelyplanet.com]

        Russia has no shortage of enemies who might false-flag them, but the short-list is still manageable. Dragonfly probably won't be able to move much without being attributed.

        Thr

    • To establish guilt in a crime, you try to identify who has means, motive, and opportunity. The working hours provide you information on opportunity; not to say that someone from China or North Korea couldn't attack during Eastern European business hours, but this tends to point to Eastern Europe as being the most likely source.

      That brings us to means. Who has the capability to launch a campaign of this scope and duration? Anybody can launch a cyberattack, but relatively few countries have the resources to

      • Re: (Score:2)

        by AHuxley ( 892839 )
        Any group can be used to fake an ip and work on shifts or use friendly 'locals' to provide the press spin of the expected evil/cover country of origin.
        Lots of software gets tested, lost, sold, re built and re tested in the wild by many different groups.
        A nation state would have real staff, real experts and real connections to the power sector to test all they like without any code needing a live test.
        Why show your hand even if you need to test live? Why risk your skilled tight code floating around for

    • Re: (Score:2)

      by c ( 8461 )

      Which government has working days like that?

      A better question is "which hackers have working days like that"? Why would anyone expect criminals to work 9-to-5 jobs? I'd expect something more along the line of noon-to-hey-let's-go-get-piss-drunk-and-sleep-in-until-noon.

  • No airgap? (Score:4, Interesting)

    by thieh ( 3654731 ) on Tuesday July 01, 2014 @10:30AM (#47359965)
    I would have thought some of these should be airgapped for security reasons by design? Is it so hard to go to work these days that you have to hook it up to the outside?

    • Re:No airgap? (Score:5, Insightful)

      by swb ( 14022 ) on Tuesday July 01, 2014 @11:13AM (#47360387)

      I've done a couple of projects with engineering companies including one at a power plant. From what I've seen, the thing that tends to lead from air gapping to lack of airgapping is support.

      The engineering companies don't have the IT infrastructure experience or skills in their engineering practice. They hired me to do basic stuff like SAN setup, switch configuration, VMware, etc.

      The engineering company is required to provide support for their subsystem for a period of a couple of years and this includes everything IT related. Their office is hundreds of miles from the plant so problems with the IT environment require them to fly someone out. This is expensive, the guy who goes out has limited troubleshooting and they turn to me.

      But they don't want to pay for my services on site, so ultimately they end up ungapping the environment so it can be supported with less cost. They have some security -- VPN only and possibly other restrictions which limit VPN connectivity, but they break the air gap.

      They could maintain the air gap, but it would cost money -- support and travel costs, etc.

      Ideally the engineering company would make IT systems part of their practice, but I think a lot of engineers have an "I'm an engineer" mentality which makes them they're good at everything, so they see this as unnecessary. They could negotiate with the plant to engage their IT resources, but that would cost them money.

      • Comment removed based on user account deletion

        • Re:No airgap? (Score:5, Funny)

          by VorpalRodent ( 964940 ) on Tuesday July 01, 2014 @12:51PM (#47361263)

          I am an engineer, but I agree with your assessment - I feel fully qualified to act as a doctor. None of my patients have complained, but if by chance one were to survive and make a fuss, I feel sufficiently competent as a lawyer that I'm sure I'd be okay.

      • I've done a couple of projects with engineering companies including one at a power plant. From what I've seen, the thing that tends to lead from air gapping to lack of airgapping is support.
        ...
        They could maintain the air gap, but it would cost money -- support and travel costs, etc.

        Ultimately, it's a profit problem. Increased costs == lower profits (at least in the short term). Possibly over the long term, a security breach could cost more than the cost of an airgapped solution.

        Alternatively, if the

    • Re: (Score:3)

      by asylumx ( 881307 )
      Stuxnet affected airgapped machines...

    • I would have thought some of these should be airgapped for security reasons by design? Is it so hard to go to work these days that you have to hook it up to the outside?

      These systems aren't just ignorantly plugged-in to an internet connection. But still, you NEED to be able to input data to them, including software updates, and you NEED to get data out, like real-time status updates sent to grid operators. Having someone typing-in every bit of data won't work, and connecting it to internet-connected syste

  • Welcome to the future! (Score:3)

    by MRe_nl ( 306212 ) on Tuesday July 01, 2014 @10:32AM (#47359991)

    People no longer have an expectation of privacy, according to Mark Zuckerberg.
    Corporations are people, according to recent laws.
    Ergo please stop whining, what goes around comes around, much like an enrichment centrifuge PLC : ).

  • There is an obvious solution

  • Comment removed (Score:3)

    by account_deleted ( 4530225 ) on Tuesday July 01, 2014 @11:08AM (#47360341)
    Comment removed based on user account deletion

    • Re:perhaps a slice of crow for the US? (Score:5, Interesting)

      by flyingsquid ( 813711 ) on Tuesday July 01, 2014 @01:28PM (#47361601)
      It's unquestionable that the U.S. has let this thing loose; the U.S. has perhaps the most advanced cyberwarfare capabilities (at least in terms of offense) as any country on earth, having developed these weapons and techniques they can't complain too much if other countries start using them as well. However the idea is that cyberwarfare, just like conventional warfare, can and should be governed by a code of conduct. The idea would be that targets that would be considered off-limits to conventional attacks would also be off-limits to cyber-attacks. So it would be considered acceptable to attack the enemy's command-and-control network, their radars, their weapons systems, or military shipping and transport... but not to attack civilian infrastructure such as electricity, water supply, trains, banks, the stock market, etc. etc. So far, U.S. actions are consistent with this policy; we have attacked Iran's nuclear facilities but haven't tried to take down their banks or power plants, even though we probably could. You can see this policy in action where the U.S. recently accused a number of Chinese soldiers of engaging in cyberwarfare against the U.S. The issue wasn't that they engaged in cyberwarfare, which we expect the Chinese to do. It was that they were attacking civilian targets for corporate espionage, and the U.S. wanted to send a message that while they expect the military to be attacked by the Chinese, and it's a legitimate target, it's not OK to target U.S. companies.

      In the current case, it would appear that Russia doesn't accept the U.S. argument that civilian infrastructure should be off-limits. Whether the U.S. can complain here or not is debatable. The U.S. has targeted civilian infrastructure during conventional operations; they knocked out the power in Serbia during actions in Kosovo, for example. So the Russians could easily argue- and not without merit- that if it's OK to take out the power in Serbia using a stealth bomber and a conventional bomb, it ought to be OK to turn out the lights in the U.S. using a logic bomb.

      • The Iranian nuclear plant is a power plant. But of course you are actually referring to the nuclear enrichment facilities which can be dual purpose civilian/military.

      • but not to attack civilian infrastructure such as electricity, water supply, trains, banks, the stock market, etc. etc.

        Dresden. Hamburg. Hiroshima. Nagasaki.

        Numerous other cities in both Germany and Japan.

        Step back to the 1800s, and we have Sherman's Neckties between Atlanta and Savannah (civilian railroads torn up by Union troops in Sherman's Army).

        And that's just the USA.

        Coventry.

        Nanking.

        Too many others to count....

      • Re: (Score:2)

        by Rich0 ( 548339 )

        The only reason the US doesn't bomb power plants is because this is counter to US interests. The US doesn't need to bomb the power plant to accomplish their objectives, and it is one less mess to deal with once they move into the decade-long mop-up before we give up and pull out.

        If the US were dealing with an adversary where it actually could lose the war, the power plants would be gone in the first night. They're trivial to disrupt. Bridges, road junctions, you name it would all be on the target list.

    • the CIA once destroyed a gas pipeline in 1982 by hacking malicious controls software into a system purchased by them from canada.

      Your summary is just absolutely AWFUL. Obviously, no Canadian pipelines were damaged... Instead the CIA had a Canadian company sabotage their own SCADA software, knowing that the Soviet KGB was going to steal their pipeline control systems, with that software on it.

      Secondly, it's a story from a single source, unconfirmed, that has been disputed by others. So it may actually hav

  • It's the Russians (Score:4, Insightful)

    by ziggystarsky ( 3586525 ) on Tuesday July 01, 2014 @11:12AM (#47360379)
    It's Russia because
    - UTC+4 is one time-zone east of moscow;
    - it shifted to energy supplying firms with the beginning of the crisis in Ukraine (where Russia's gas delivieries are considered as the its only trump)
    - it's either Russia or China in general
  • Hmmm... Did anyone just say why don't we use this opportunity of reliance upon centralized power and the weakness thereof to get rid of the energy cartels and rely on decentralized power instead, thus making our nations stronger, more independent and resilient to both attacks and natural disasters ? Just food for thought on a day that Solar Power just got greener and not to mention cheaper http://www.geek.com/science/se... [geek.com] The fact that power companies are being "attacked" is old news - The right path to

  • TBH I'd be more worried... (Score:3)

    by Torp ( 199297 ) on Tuesday July 01, 2014 @01:17PM (#47361493)

    ... about the ones Symantec doesn't know about.
    Also, I don't remember Symantec doing anything useful since like, forever. I remember them for purchasing Norton Utilities and turning them into a bloated mess. Should we trust them on this, or is their marketing department manufacturing a threat? :)

  • Are we not worthy of even a tiny mention at the footnote? I feel like I live somewhere that has no influence on the global stage any more. That can't be right. Oh, wait ..

    • Re: (Score:2)

      by AHuxley ( 892839 )
      Options:
      MI6 warned the UK gov and was privately able to secure the power sector over a very long time.
      GCHQ was working with the power sector over a very time.
      The UK power sector is air gapped with unionized staff at each site unreachable by most modern internet code floating around.
      All the other nations listed rebuilt their power sectors with a series of open internet connections. Very few top staff member with laptops could complete their tasks off site via the internet at a lower cost.
      The only aspec

  • NSA operations are spelt with capitals.

    Oh, you mean western countries including the U.S., Spain, France, Italy, Germany, Turkey, and Poland are currently the victims of an ongoing cyberespionage campaign, launched by somebody apart from the NSA as well?

Slashdot Top Deals

It is easier to write an incorrect program than understand a correct one.

Close